fix(deps): dependabot remediation 2026-06-26 (tkhq/sdk)

[arawal]

Dependabot remediation

Adds pnpm-workspace.yaml overrides to address 7 advisories. Lockfile regenerated via corepack pnpm install --lockfile-only. The override declares the floor; the actual version change lands in pnpm-lock.yaml.

js-yaml → >=4.1.1

#979 · GHSA-h67p-54hq-rp68
What changed: Fixes quadratic-complexity DoS in merge-key (<<) handling via repeated aliases — parsing crafted YAML could hang. No public API change.

markdown-it → >=14.1.2

#981 · GHSA-6v5v-wf23-fmfq
What changed: Fixes quadratic-complexity DoS in the smartquotes rule's replaceAt string handling on crafted input. Behavior-preserving.

@opentelemetry/core <2.8.0 → ^2.8.0

#980 · GHSA-8988-4f7v-96qf
What changed: Fixes unbounded memory allocation in W3C Baggage propagation (W3CBaggagePropagator.extract) on oversized baggage headers. Minor-version bump within 2.x.

ua-parser-js → >=2.0.10

#959 · GHSA-9h5v-pfqq-x599
What changed: Fixes ReDoS in Sec-CH-UA-Model parsing within withClientHints() (unbounded regex). No API change.

uuid → ^11

#876 · GHSA-w5hq-g745-h8pq
What changed: Adds the missing buffer-bounds check in v3/v5/v6 when a caller passes an explicit buf/offset (could write out of bounds). Major bump from older line; we use v4 codepaths only.

@eslint/plugin-kit → >=0.3.4

#996 · GHSA-xffm-g5w8-qvg7
What changed: Fixes ReDoS in ConfigCommentParser#parseJSONLikeConfig (unanchored regex). Dev/lint-time only.

tough-cookie → >=4.1.3

#30 · GHSA-72xf-g2v4-qvf3
What changed: Fixes prototype pollution via crafted cookie domain (__proto__) in CookieJar memory store. Behavior-preserving.

@babel/core already overridden on main (<=7.29.0: ^7.29.6), skipped.

Note: PR #1263 should be closed as stale — main moved overrides from root package.json to pnpm-workspace.yaml with broader coverage.

Auto-opened by the Dependabot remediation workflow.

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit c01f568:

Sandbox	Source
@turnkey/example-react-components	Configuration

[mssabr01]

LGTM